Terms of use

Version 2026-10-29, effective from 29 October 2026.

1. Who we are and who these Terms apply to

Routevance is an online service for planning and following the work of field technicians. It is provided by SNJ Media Studio S.r.l., Via Serviliano Lattuada 26, 20135 Milan, Italy, VAT number IT04886260969, tax code 04886260969, REA MI-1779932, share capital of EUR 20,000, fully paid up ("SNJ" or "we").

These Terms govern the use of Routevance by the company that signs up on the website ("the Customer") and by the people the Customer gives an account to. The service is for businesses and professionals only: whoever signs up declares that they act on behalf of a company or in the course of their profession, and that they have the authority to accept these Terms on its behalf. The provisions of the Italian Consumer Code on consumer contracts do not apply.

These Terms also apply to a Customer that buys Routevance on AWS Marketplace, which accepts them when it activates the account from the Routevance registration page. The terms on the product page on AWS also apply to the subscription (section 4).

2. How the contract is formed

The contract is formed when the Customer completes the sign-up, on the website or on the AWS Marketplace activation page, with the two acceptance checkboxes: the first for these Terms, the second for the specific approval of the clauses listed in section 14. We record the version of the Terms accepted, with date and time. The contract is in Italian. Every version remains available: the current one at this address, earlier ones on request at routevance@snjmediastudio.com. After sign-up the administrator receives an email with a link to set the password, valid for 7 days.

3. The service

Routevance lets the Customer manage branches, technicians, jobs and routes and follow the work during the day. It sends the Customer's end clients a link to follow the technician's arrival, a link to rate the job and the job certificate. The available features are those the application shows at the time of use.

We may improve and change the service. If we remove a feature included in the Customer's active plan, we tell the administrators by email at least 30 days in advance.

Travel times, estimated arrival times and suggested addresses are estimates, partly calculated with third-party services (Google Maps Platform). They help organise the work and do not guarantee actual times.

4. Plans

• Free: free of charge with no end date, up to 3 technicians, 1 branch and 15 users. It is the only plan activated by signing up on the website.
• Pro and Business: paid plans, bought on AWS Marketplace, which bills them to the Customer's AWS account. Prices, term, renewal and cancellation are those on the product page on AWS. The AWS Marketplace terms apply to the subscription bought; these Terms apply to everything else, including the data processing agreement.

If a subscription bought on AWS Marketplace ends or is cancelled, a Customer that started on the Free plan goes back to Free and keeps all its data. Existing technicians, branches and users stay active even above the Free limits, but while they exceed the limit no new ones can be added. Features reserved for paid plans are no longer available.

A Customer that signed up directly from AWS Marketplace has 30 days from the end of the subscription to download its data; after that we delete it.

5. Accounts and credentials

The Customer appoints one or more administrators, who invite the other users and decide their roles. Each user keeps their own credentials safe and does not share them. The Customer is responsible for how the service is used with its company's accounts and, if it suspects unauthorised access, tells us at once by writing to routevance@snjmediastudio.com.

6. Permitted use and suspension

The Customer undertakes not to:

• use the service for unlawful activities or to process personal data without a legal basis;
• upload content that infringes third-party rights;
• try to access other Customers' data or to get around plan limits and security measures;
• overload the service with automated requests beyond what the documented API allows;
• resell the service or make it available to third parties without our written consent.

If the Customer breaches these rules we may suspend the account. We first warn the Customer by email and give it a chance to put things right, unless waiting would put the security of the service or of other Customers' data at risk, or the law requires us to act at once.

7. Customer data

The data the Customer enters (technicians, end clients, jobs, photos, signatures, locations) remains the Customer's. We process it only to provide the service, as processor on behalf of the Customer, under the data processing agreement set out at the bottom of this page, which forms part of these Terms.

The Customer is the controller of this data: it decides what to enter, informs its technicians and end clients, and collects consent where needed. The application lets the Customer add a link to its own privacy notice, which appears in the technicians' app, on the pages for end clients and in the email with the job certificate.

The Customer can export all its data as an archive from the administration section at any time.

8. Availability and support

We work to keep the service running and to restore it quickly after a failure, but we do not guarantee a minimum level of availability unless agreed otherwise in writing. We announce scheduled maintenance that interrupts the service to the administrators at least 48 hours in advance and carry it out, where possible, outside Italian working hours.

Support requests go by email to routevance@snjmediastudio.com, Monday to Friday from 9:00 to 18:00 (Italian time), excluding public holidays. Integrations, custom configuration and other work beyond ordinary support are requested from the button on the Integrations page and are charged separately, by quotation.

9. Intellectual property

The software, the Routevance trademark and the content of the service belong to SNJ or its licensors. The Customer receives a non-exclusive, non-transferable right of use, for the term of the contract and for its own business.

10. Liability

We are liable for damage that is the direct and immediate consequence of a breach on our part. We are not liable for lost profits, lost business opportunities, indirect or unforeseeable damage, or damage caused by third-party services that are not our sub-processors (for example the Customer's internet connection or the services listed in Annex C) or by use of the service contrary to these Terms.

For the Free plan our total liability does not exceed 100 euros. For paid plans it does not exceed what the Customer paid for Routevance in the 12 months before the event that caused the damage.

These limits do not apply to damage caused by wilful misconduct or gross negligence, to personal injury, or in other cases where the law does not allow liability to be limited. Liability to data subjects under the GDPR is not affected.

11. Term, termination and closure

The contract for the Free plan has no fixed term. The Customer can close the account at any time from the administration section, confirming with the company name. From the request it has 30 days to download its data or cancel the closure. After the 30 days we permanently delete the company's data; backup copies expire on their own within the times set out in the data processing agreement.

We may terminate the contract with 60 days' notice, sent by email to the administrators. In the event of a serious breach of section 6 we may terminate with immediate effect. In every case the Customer has 30 days to download its data.

12. Changes to these Terms

If we change these Terms, we publish the new version at this address with a new version number. We also send it to the administrators by email at least 30 days before it takes effect. A Customer that does not accept the changes can close the account before that date; otherwise the new version applies from the stated day. Changes required by law or by an authority may be notified at shorter notice.

If a change concerns the clauses listed in section 14, the new version applies to the Customer only after it has specifically approved it in the application. Until then, the previous version of those clauses stays in force.

13. Governing law and jurisdiction

These Terms are governed by Italian law. The courts of Milan have exclusive jurisdiction over any dispute about these Terms. These Terms are written in Italian; this English version is a translation, and if the two differ the Italian version prevails.

14. Specific approval

Under articles 1341 and 1342 of the Italian Civil Code, the Customer specifically approves, with the second checkbox at sign-up, the following sections: 6 (account suspension), 8 (service availability), 10 (limits of liability), 11 (termination), 12 (changes to these Terms) and 13 (jurisdiction).

15. Contact

For these Terms the Customer can write to routevance@snjmediastudio.com; for personal data protection, to privacy@snjmediastudio.com.

Data processing agreement (Art. 28 GDPR)

This agreement forms part of the Terms of use and is made between the Customer, as controller ("Controller"), and SNJ Media Studio S.r.l., as processor ("Processor"). It also applies to anyone who uses Routevance after a purchase on AWS Marketplace.

A1. Subject matter and instructions

The Processor processes the personal data that the Controller and its users enter in Routevance only to provide the service and only on the Controller's documented instructions. The instructions are the Terms, this agreement and the settings chosen in the application, for example retention periods. If the Processor thinks an instruction infringes data protection law, it says so at once.

A2. Nature, purpose and duration

• Nature: collection, recording, organisation, storage, consultation, route calculation, disclosure to the recipients chosen by the Controller, anonymisation and erasure.
• Links for end clients: the service sends end clients the links generated by the Controller's users. The page to follow the technician's arrival, valid for 3 days, shows the technician's first name (no surname), the number plate, the type of service and the job address. The rating page, valid for 30 days after the job is closed, shows the technician's first name, the date, the type of service and the number plate.
• Purpose: planning and managing the technicians' jobs, calculating routes, keeping end clients informed of progress, collecting signatures, photos and ratings, producing job certificates and work statistics per technician.
• Duration: the term of the contract, plus the time needed for the erasure described in section A9.

A3. Data subjects and categories of data

The service is not designed for special categories of data (Art. 9 GDPR) or for data on criminal convictions. The Controller undertakes not to enter them in free-text fields.

To authenticate users, protect accounts and manage the contract, SNJ processes usernames, emails and login data as an independent controller, under the Routevance privacy notice.

Technicians' location.

• When: the service records the location of the technician's device only within the day's shift window (from 30 minutes before the start to 60 minutes after the end) and only while the technician has open jobs.
• What it keeps: only the latest position, with no history.
• Frequency: the device sends it every 2 minutes while the app is open, at every change of job status and when the app is reopened. The server ignores updates that arrive less than 30 seconds after the previous one.
• Erasure: as soon as the technician has no open jobs left, and in any case within 60 minutes of the end of the shift, with a check every 10 minutes.
• Notice: before the first update the technician sees a notice explaining what is collected.

For the technicians' location and work statistics, the Controller is responsible for identifying the legal basis and for meeting its obligations towards workers, including Art. 4 of Italian Law 300/1970.

A4. Processor's obligations

The Processor:

1. processes the data only on the Controller's documented instructions, including for transfers to third countries, unless the law requires otherwise; in that case it informs the Controller first, if the law allows;
2. ensures that the people who process the data are bound by confidentiality;
3. implements the security measures in Annex A;
4. engages other processors only on the conditions in section A5;
5. helps the Controller answer requests from data subjects, as set out in section A6;
6. helps the Controller with the obligations in Arts. 32 to 36 GDPR, with the information available to it;
7. at the end of the service erases or returns the data as set out in section A9;
8. makes available the information needed to show compliance with this agreement and allows the audits in section A8.

A5. Sub-processors

The Controller gives general authorisation to the sub-processors listed in Annex B. The Processor tells the Controller's administrators by email about any added or replaced sub-processor at least 30 days before the change takes effect. Within that period the Controller may object on data protection grounds; if the parties cannot find a solution, the Controller may terminate the contract without penalty.

The Processor imposes on its sub-processors data protection obligations equivalent to those in this agreement and remains fully liable for the performance of their obligations.

The following are not sub-processors:

• recipients chosen by the Controller, for example the automatic notification addresses (webhooks) set up by its administrators;
• services a technician opens from their own phone: navigation in Google Maps, which receives the addresses of the stops, and WhatsApp or SMS messages to the end client, sent through the phone's own app with the number and the message text. These services process the data under their own terms;
• the services listed in Annex C, which process the data as independent controllers or as mere transmission channels.

A6. Data subjects' rights

The Processor forwards to the Controller, without delay, any request it receives directly from data subjects. To help the Controller respond, the application gives administrators:

• search, JSON export and correction of an end client's data;
• anonymisation of an end client across all closed jobs, with deletion of photos and signatures;
• export of a technician's or a user's data;
• full export of the company's data in a ZIP archive.

Every operation is kept in the activity log. The application does not yet let administrators delete a single technician or user with all their data: on the Controller's written request, the Processor does it within 30 days.

A7. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it. The notice contains the information in Art. 33(3) GDPR available at that time; the Processor then updates the Controller as it gathers more.

The notice goes to the email addresses of the Controller's administrators registered in Routevance.

A8. Audits

On request, the Processor provides an up-to-date description of the security measures and the sub-processors. The Controller, or an auditor it appoints who is bound by confidentiality, may carry out inspections agreed with at least 30 days' notice, except after a breach. Inspections are at the Controller's expense and give no access to other Customers' data.

A9. Retention, return and erasure

During the contract, data is kept for the periods the Controller sets in the application. If the Controller does not change them, these apply:

Automatic deletion runs every night; for location, every 10 minutes.

When the administrator asks to close the account, or when an AWS Marketplace subscription ends without a return to the Free plan, the Controller has 30 days to download the full data archive. After the 30 days the Processor erases all the Controller's data, including files and the related entries in the address cache. Only the lines of the technical log and the backup copies remain, until they expire.

Backup copies expire and are deleted automatically. Database copies are kept for 14 days on the server and 35 days on S3, plus 7 days as a previous version (42 in total). For copies of the whole server, the latest 7 daily ones are kept.

A10. Transfers outside the European Economic Area

The service data is stored in the AWS Frankfurt region (Germany). For any access by AWS from third countries, the European Commission's standard contractual clauses in the AWS data processing addendum apply.

The services in Annex C may also process data outside the European Economic Area: Google, including in the United States, with Google LLC's participation in the EU-US Data Privacy Framework; push services, depending on the browser. The weather service keeps its access logs in its own data center in Oslo, within the European Economic Area.

A11. Liability and precedence

Liability is governed by Art. 82 GDPR and section 10 of the Terms. If this agreement and the Terms conflict, this agreement prevails on data protection matters.

Annex A: technical and organisational measures

• Encryption in transit: HTTPS required, with HSTS; certificates renewed automatically.
• Credentials: passwords stored with BCrypt; single-use reset link valid for 2 hours; invitations valid for 7 days.
• Sessions: access tokens valid for 2 hours. Refresh tokens are stored only as a SHA-256 hash and change at every use; if one that has already been replaced is reused, and when the password changes, all sessions are revoked.
• Login protection: at most 10 attempts every 15 minutes per IP address, and progressive account lockout from 1 to 30 minutes.
• Separation between Customers: the application applies a company filter to every database read; the few exceptions are tied explicitly to the user's company.
• Data minimisation: location data (EXIF) is removed from photos on upload; pages for end clients do not show the technician's location and load no third-party services.
• Browser security headers: Content Security Policy, a ban on embedding the pages in other websites, protection against misread file types (nosniff), geolocation allowed only to the application.
• Backups: a daily copy of the database, encrypted with AES-256-GCM before it leaves the server; the key to decrypt it is not kept on the server. The copy goes to S3, with server-side encryption and credentials that only allow uploads. A daily copy of the whole server is also taken (Lightsail snapshot).
• Traceability: the activity log keeps the operations on personal data (exports, anonymisations, account closure).
• Organisation: access to the servers and to the AWS console is limited to the SNJ staff who run the service.

Annex B: sub-processors

Annex C: third-party services that are not sub-processors

These services receive data when the service uses them, but they do not process it on the Processor's behalf: Google processes Maps Platform data as an independent controller, under its own controller-to-controller data protection terms; push services are transmission channels chosen by the user's browser; the weather service is a Norwegian public body that receives the rounded branch coordinates and the IP address of the Routevance server; it keeps the access logs for its own purposes (security, troubleshooting and statistics), under its own privacy policy and terms of service.